Apache HTTP Server 2.4.71 patches critical remote code execution in mod_http2
On November 11, 2026 Apache shipped HTTP Server 2.4.71 to fix CVE-2026-119618, a remote code execution flaw in the HTTP/2 module mod_http2, discovered independently by Anthropic and Google Cloud. Upgrade to 2.4.71 or disable mod_http2 — the flaw reaches any server with HTTP/2 enabled, with no prior authentication.